Migrating Microsoft workloads to public cloud platforms introduces licensing complexities that can significantly affect both compliance posture and total cost of ownership. Microsoft's licensing rules differ substantially depending on whether workloads run on Azure (where Microsoft offers the most favourable terms), AWS, or Google Cloud Platform (where "Listed Provider" restrictions apply). Understanding the differences between Bring Your Own Licence (BYOL) and provider-included licensing, Azure Hybrid Benefit mechanics, License Mobility through Software Assurance, dedicated host requirements for non-Azure clouds, and the common compliance pitfalls that organisations encounter during migration is essential for avoiding unexpected costs and maintaining licensing compliance throughout the cloud transition.
Cloud providers offer two fundamental approaches to licensing Microsoft software in their environments. Understanding the distinction is the starting point for any cloud migration licensing strategy. Provider-included licensing means the cloud provider includes the cost of the Microsoft licence in the hourly or monthly VM pricing — the organisation pays a higher compute rate that covers the operating system or application licence. This is the simplest approach: no existing licences are needed, and the provider handles the Microsoft licensing relationship. BYOL (Bring Your Own Licence) means the organisation takes licences it already owns — typically from on-premises volume licensing agreements with Software Assurance — and applies them to cloud instances, paying only the lower base compute rate for the VM. For broader context, see: Microsoft Licensing Knowledge Hub.
The choice between these models depends on the organisation's existing licence entitlements, the specific cloud provider, the products being migrated, and the cost comparison between BYOL and provider-included pricing. Azure Hybrid Benefit (AHB) can reduce VM costs by 40–50% for organisations with existing Windows Server or SQL Server licences with Software Assurance — a saving that compounds significantly across large server estates and multi-year cloud commitments. On AWS and GCP, BYOL is possible but subject to more restrictions due to Microsoft's "Listed Provider" policies introduced in 2019. The licensing rules are product-specific, cloud-specific, and depend heavily on whether the organisation has active Software Assurance — making a thorough licence inventory an essential prerequisite before any migration planning begins.
The financial impact of getting this decision right is substantial. An organisation migrating 100 Windows Server VMs to Azure with AHB instead of licence-included pricing can save hundreds of thousands of dollars annually. Conversely, an organisation that deploys Windows Server on AWS shared infrastructure assuming BYOL is permitted — when it is not under Listed Provider restrictions — faces both compliance exposure and the cost of retroactive licence purchases. The stakes are high enough that licensing should be treated as a first-class migration planning concern alongside technical architecture, security, and network design, not as an administrative afterthought to be resolved after workloads have already been deployed and are running in the cloud environment.
As Microsoft's own cloud platform, Azure offers the most straightforward and flexible licensing options for migrating Microsoft workloads. Microsoft has deliberately structured Azure's licensing terms to make it the most economically attractive destination for organisations with existing Microsoft licence investments, creating significant incentives for customers to choose Azure over competing cloud platforms for Microsoft workloads.
AHB allows organisations to use on-premises Windows Server and SQL Server licences with active Software Assurance on Azure VMs, avoiding double-payment for licences. For Windows Server, each 16-core Datacenter licence covers up to 16 cores of Azure VMs. For SQL Server, AHB applies to both Azure VMs and Azure SQL managed services, yielding 30–50% savings. AHB represents the single largest cost optimisation opportunity for organisations migrating Microsoft workloads to Azure.
SQL Server Enterprise with Software Assurance and AHB enables an unlimited virtualisation benefit on Azure — organisations can run any number of SQL Server instances on Azure Dedicated Hosts without licensing each VM's cores separately, mirroring the on-premises unlimited virtualisation right. This is particularly valuable for organisations with large SQL Server estates where per-core licensing on individual VMs would be prohibitively expensive.
Azure Dedicated Host provides an entire physical server dedicated to a single customer. This satisfies licensing requirements for products that cannot be used on shared cloud infrastructure under standard terms, and enables BYOL for older licences or those without Software Assurance. Microsoft treats Azure Dedicated Host similarly to on-premises hardware from a licensing perspective, providing maximum licensing flexibility for complex migration scenarios.
Azure Hybrid Benefit includes up to 180 days of simultaneous use rights during migration — the organisation can run workloads on-premises and in Azure concurrently while transitioning. This dual-use period is critical for migration testing, validation, and cutover without requiring additional licence purchases for the overlap period. AWS and GCP offer no equivalent blanket dual-use allowance.
Amazon Web Services and Google Cloud Platform are classified by Microsoft as "Listed Providers" — a designation introduced in October 2019 that imposes significant restrictions on how existing Microsoft licences can be used on their infrastructure. Since this policy change, Microsoft has restricted the ability of customers to bring perpetual Windows Server licences to Listed Providers on shared (multi-tenant) infrastructure, effectively requiring either provider-included licensing (at the higher rate that includes the Windows Server licence cost) or BYOL on dedicated host infrastructure where the customer has sole tenancy of the physical server for Windows Server workloads. These restrictions do not apply to Azure, creating a deliberate and substantial competitive advantage for Microsoft's own cloud platform that has drawn regulatory scrutiny in multiple jurisdictions but remains in effect.
The practical impact of the Listed Provider restrictions is that organisations running Windows Server on AWS or GCP face a binary choice: pay the provider-included rate (which includes the Windows Server licence cost and is significantly higher than the base compute rate), or provision dedicated host infrastructure and apply existing Windows Server licences to that dedicated hardware. Dedicated hosts provide sole tenancy but carry additional infrastructure costs and reduce the flexibility benefits that make public cloud attractive in the first place. For SQL Server and other server applications eligible for License Mobility, the restrictions are less severe — BYOL on shared infrastructure is permitted with active Software Assurance — but the administrative requirements are more demanding than Azure's streamlined AHB activation process.
| Product | Azure | AWS / GCP (Listed Providers) |
|---|---|---|
| Windows Server (with SA) | BYOL via AHB on shared VMs; 180-day dual-use | BYOL only on dedicated hosts; no dual-use rights |
| Windows Server (without SA) | BYOL on Dedicated Host; provider-included on shared | Provider-included only (no BYOL on shared infrastructure) |
| SQL Server (with SA) | BYOL via AHB on shared VMs and managed services | BYOL via License Mobility on shared VMs (verification required) |
| SQL Server (without SA) | Provider-included or Dedicated Host BYOL | Provider-included only (no License Mobility without SA) |
| Office applications | Microsoft 365 licences usable on Azure Virtual Desktop | Volume-licensed Office not permitted on shared infrastructure |
| Azure consistently offers the most favourable BYOL terms — AWS/GCP require SA and often dedicated hosts | ||
Cloud migration introduces several licensing compliance risks that organisations frequently encounter. These pitfalls can result in unexpected licence purchases, back-dated support fees, or audit findings if not identified and addressed proactively during migration planning. The following are the most common and most costly compliance mistakes. For audit defence support, see: Microsoft Audit Defence Service.
The most common financial waste during migration is paying for licences twice — using provider-included VM pricing while also holding unused on-premises licences that could have been applied via BYOL. This happens when cloud teams launch VMs with licence-included images without consulting the licensing team about existing entitlements. The reverse also occurs: organisations assume BYOL is applied when it is not, paying the full provider-included rate unknowingly. Solution: inventory existing licences before migration and create explicit deployment procedures that ensure BYOL options (AHB on Azure, dedicated hosts on AWS/GCP) are selected when entitlements exist.
The compliance risk of deploying licences on cloud infrastructure without meeting Microsoft's requirements. Common violations include deploying Windows Server perpetual licences (without SA) on AWS or GCP shared VMs — this is not permitted under Listed Provider restrictions. Or deploying SQL Server without active Software Assurance on shared third-party infrastructure — License Mobility requires active SA. These violations are easily detected during Microsoft audits and result in retroactive licence purchases at list price plus back-dated support fees.
Many organisations are unaware that Microsoft treats AWS, GCP, and Alibaba Cloud differently from other hosting providers. The Listed Provider restrictions, introduced in 2019, prevent standard BYOL of Windows Server licences on shared infrastructure at these specific providers. Organisations that migrated to AWS or GCP before 2019 under previous terms may have grandfathering rights, but new licence deployments are subject to the current restrictions. Smaller cloud providers that are not on Microsoft's Listed Provider list may still allow BYOL under standard outsourcing terms — the restrictions apply specifically to the named providers.
A strategic pitfall rather than a compliance issue: migrating on-premises servers directly to cloud VMs (lift-and-shift) without evaluating whether cloud-native PaaS services could replace the workload at lower cost and with simpler licensing. For example, Azure Files or SharePoint Online may replace a Windows Server file server VM, and Azure SQL Database may replace a SQL Server VM — in both cases, the PaaS service includes licensing in its pricing, eliminating BYOL complexity entirely. Evaluating PaaS alternatives during migration planning can simplify licensing and reduce total cost of ownership.
Microsoft has deliberately structured licensing terms to make Azure the most attractive destination for existing Microsoft licence holders. This licensing advantage is a significant factor in cloud platform selection for organisations with substantial Microsoft licence investments, and should be evaluated alongside technical requirements, existing cloud relationships, and multi-cloud strategy considerations when making platform decisions.
Azure Hybrid Benefit: Up to 40–50% savings on Windows Server and SQL Server VMs by applying existing licences — no equivalent benefit on AWS or GCP.
Dual-use rights: 180 days of simultaneous on-premises and Azure use during migration — AWS and GCP offer no equivalent.
Extended Security Updates: Free ESUs for end-of-support products (Windows Server 2012, SQL Server 2012) on Azure — AWS and GCP require paid ESU purchases through Software Assurance.
| Scenario | Azure (with AHB) | AWS (Licence Included) | AWS (BYOL Dedicated Host) |
|---|---|---|---|
| Windows Server VM (8 cores, standard) | ~40% less than licence-included | Full rate (includes Windows licence) | Base rate + dedicated host fee |
| SQL Server Enterprise VM (16 cores) | ~50% less via AHB | Very high (SQL EE licence-included rate) | Base rate + SA-covered BYOL |
| Windows Server 2012 (end-of-support) | Free ESUs included | ESU purchase required | ESU purchase required |
| Azure consistently delivers 20–50% lower TCO for Microsoft workloads through AHB and included ESU benefits | |||
List all Microsoft licences (Windows Server, SQL Server, Remote Desktop, Office), their versions, and Software Assurance status. Determine which licences are eligible for BYOL and on which cloud platform. Map each workload to the target cloud platform and the licensing approach (BYOL or provider-included). Evaluate PaaS alternatives that could eliminate VM licensing requirements entirely. Calculate cost comparisons for each workload across Azure, AWS, and GCP including licensing costs.
Ensure cloud teams select the correct BYOL or AHB options when provisioning VMs — a misconfigured deployment defaults to provider-included pricing. Submit License Mobility verification forms to Microsoft for BYOL deployments on AWS/GCP. Use the 180-day dual-use period on Azure to run parallel environments during testing and cutover. Monitor that on-premises licence usage is retired after the dual-use period expires. Verify that dedicated hosts are provisioned for any Windows Server BYOL on AWS/GCP.
Establish ongoing licence governance for cloud environments — new VMs, scale-outs, and service changes can alter the licensing posture. Regularly audit cloud accounts to verify that Microsoft software deployments match licence entitlements. Monitor Software Assurance renewal dates — if SA lapses, License Mobility and AHB rights expire. Review provider-included versus BYOL economics periodically as pricing and licence holdings change. Consider consolidating Microsoft workloads on Azure if licensing economics justify the platform choice. See: Microsoft Optimisation Services.
Windows Server and SQL Server are the two most commonly migrated Microsoft products, and they have distinctly different BYOL rules that organisations must understand in detail before planning cloud deployments. Windows Server licensing in the cloud is governed primarily by the Listed Provider restrictions and the availability of Azure Hybrid Benefit, while SQL Server licensing is governed by License Mobility through Software Assurance and the core-based licensing model that applies across all cloud platforms.
For Windows Server, the critical distinction is between Azure and all other cloud platforms. On Azure, organisations with Windows Server Datacenter or Standard licences with active Software Assurance can use Azure Hybrid Benefit to apply those licences to standard shared VMs — each 16-core licence covers up to 16 cores of Azure VM capacity. Windows Server Datacenter licences provide unlimited virtualisation rights on Azure Dedicated Hosts, mirroring the on-premises benefit. On AWS and GCP, Windows Server BYOL is only permitted on dedicated host infrastructure where the customer has sole tenancy of the physical server — standard shared VMs require provider-included licensing at the higher rate. This restriction applies to both Datacenter and Standard editions and is the single most significant licensing difference between Azure and competing cloud platforms for Microsoft workloads. For detailed guidance, see: Windows Server and SQL Server Licensing Guide.
For SQL Server, License Mobility through Software Assurance enables BYOL on shared infrastructure across all cloud platforms — including AWS and GCP — provided the organisation maintains active SA. SQL Server Enterprise licences with SA also qualify for the unlimited virtualisation benefit on Azure Dedicated Hosts, allowing any number of SQL Server instances without per-core licensing. On AWS and GCP, SQL Server BYOL requires submitting a License Mobility verification form to Microsoft, and the organisation must ensure that core licensing calculations account for the physical cores allocated to the VM (not just virtual cores). SQL Server Standard edition follows the same License Mobility rules but does not include the unlimited virtualisation benefit — each VM must be individually licensed based on its core allocation.
Organisations with active Microsoft Enterprise Agreements should evaluate their EA terms carefully before planning cloud migrations, as the EA may contain provisions that affect cloud licensing economics. Many EAs include Azure consumption commitments (MACC — Microsoft Azure Consumption Commitment) or Azure credits that can offset cloud compute costs. Some EAs include specific BYOL provisions or Azure Hybrid Benefit entitlements that are documented in the agreement's product terms. Understanding these provisions before migration ensures the organisation captures all available benefits and avoids duplicating costs by paying for provider-included licensing when BYOL entitlements already exist under the EA.
EA renewal timing is also strategically relevant to cloud migration. Organisations planning significant cloud migrations should time the migration to align with EA renewal negotiations, where the shifting balance between on-premises and cloud usage can be leveraged to negotiate better Azure pricing, additional Hybrid Benefit entitlements, or more favourable SA renewal terms. Microsoft's account teams are motivated to demonstrate Azure adoption growth, and organisations that can commit to Azure migration timelines during EA negotiations often secure more aggressive discounts than those negotiating cloud terms separately. For EA optimisation support, see: Microsoft EA Optimisation Service. For contract negotiation assistance, see: Microsoft Contract Negotiation Service.
Organisations should also evaluate whether their EA's Software Assurance coverage is optimised for the cloud migration plan. SA is the key that unlocks both Azure Hybrid Benefit and License Mobility — without SA, most BYOL options become unavailable. If the organisation plans to migrate most Windows Server and SQL Server workloads to Azure within the next EA term, maintaining SA on those licences is essential for capturing AHB savings. Conversely, if workloads are being decommissioned or replaced with PaaS services that include licensing in their pricing, maintaining SA on those specific licences may represent unnecessary and avoidable cost that should be eliminated. The SA coverage decisions should be made deliberately on a workload-by-workload basis on the specific migration plan for each server and application.
Migrating Microsoft workloads to Azure, AWS, or GCP is not merely a technical exercise — it is a licensing exercise that can significantly affect both compliance posture and total cost of ownership. Azure offers the most favourable licensing terms for Microsoft products through Azure Hybrid Benefit, 180-day dual-use rights during migration, included Extended Security Updates for end-of-support products, and the complete absence of Listed Provider restrictions that affect AWS and GCP deployments. AWS and GCP require careful and deliberate navigation of BYOL rules, License Mobility requirements through Software Assurance, and dedicated host provisions that add both complexity and direct infrastructure cost to Microsoft workload deployments on these competing platforms.
The most important actions for any organisation planning a cloud migration are: conducting a thorough licence inventory before migration begins, understanding the specific BYOL rules for each product on each cloud platform, ensuring that cloud deployment procedures incorporate licensing considerations (not just technical requirements), and establishing ongoing licence governance to maintain compliance as cloud environments evolve and grow over time. Organisations that treat licensing as a first-class migration planning activity — rather than an administrative afterthought addressed after workloads are already running — consistently achieve better cost outcomes, avoid the compliance pitfalls that catch unprepared organisations during Microsoft audits, and make more informed cloud platform decisions that reflect the true total cost of ownership including licensing. For organisations that need assistance with cloud migration licensing strategy, licence optimisation, or Microsoft contract negotiations, independent advisory firms like Redress Compliance provide the specialist expertise and complete vendor-independent objectivity needed to navigate this complex and financially significant landscape with confidence and fiscal prudence.
It depends on the product and whether you have active Software Assurance. SQL Server and other server applications eligible for License Mobility can be used on AWS/GCP shared infrastructure with active SA. However, Windows Server cannot be used on shared AWS/GCP infrastructure under normal terms — BYOL for Windows Server on these platforms requires dedicated host infrastructure where the customer has sole tenancy. Microsoft classifies AWS, GCP, and Alibaba as "Listed Providers" with specific restrictions that do not apply to Azure or smaller hosting providers.
Azure Hybrid Benefit (AHB) allows organisations to apply on-premises Windows Server and SQL Server licences with active Software Assurance to Azure VMs, paying only the base compute rate instead of the full licence-included rate. Savings are typically 40–50% for Windows Server VMs and 30–50% for SQL Server VMs compared to standard Azure pricing. AHB can also be applied to Azure SQL managed services, making it one of the most significant cost optimisation opportunities for organisations migrating Microsoft workloads to Azure.
In 2019, Microsoft introduced restrictions that prevent customers from bringing perpetual Windows Server licences to AWS, GCP, and Alibaba Cloud on shared (multi-tenant) infrastructure. On these "Listed Providers," Windows Server BYOL requires dedicated host infrastructure. These restrictions do not apply to Azure or to smaller hosting providers. The policy creates a significant licensing advantage for Azure when running Windows Server workloads, as Azure allows BYOL on standard shared VMs through Azure Hybrid Benefit.
For most BYOL scenarios on third-party clouds (AWS, GCP), yes — active Software Assurance is required. License Mobility, which enables BYOL for SQL Server and other eligible products on shared third-party infrastructure, requires active SA. Azure Hybrid Benefit also requires SA or equivalent subscription licences. Without SA, the main options are provider-included licensing (paying the full rate) or BYOL on dedicated host infrastructure, which carries additional costs.
On Azure, yes — Azure Hybrid Benefit includes up to 180 days of dual-use rights, allowing organisations to run the same licensed software on-premises and in Azure simultaneously during migration. This is critical for testing, validation, and cutover without purchasing additional licences. AWS and GCP do not offer equivalent dual-use rights — when using BYOL on these platforms, the licence should technically be decommissioned from on-premises use when deployed to the cloud.
From a licensing economics perspective, Azure is consistently the most cost-effective platform for Windows Server and SQL Server workloads due to Azure Hybrid Benefit, dual-use rights, free Extended Security Updates for end-of-support products, and the absence of Listed Provider restrictions. Many organisations report 20–40% lower total cost of ownership for Microsoft workloads on Azure compared to AWS or GCP. However, the cloud platform decision should also consider technical requirements, existing cloud relationships, multi-cloud strategy, and non-Microsoft workloads where AWS or GCP may offer advantages.
If Software Assurance lapses, License Mobility rights and Azure Hybrid Benefit eligibility expire. The organisation must either renew SA, switch to provider-included licensing (paying the full VM rate including the licence), or remove the workloads from the cloud. This is a significant ongoing cost consideration — SA renewal costs must be factored into the total cost of ownership for any BYOL cloud deployment to ensure that the BYOL savings exceed the SA renewal costs over the planning horizon.
Redress Compliance provides independent advisory on Microsoft cloud migration licensing, Azure Hybrid Benefit optimisation, BYOL compliance, audit defence, and contract negotiation. No Microsoft partnerships, reseller relationships, or referral arrangements.